Privacy policy

What we collect

• Your order: your name, email, optional WhatsApp number, your website’s address and hosting company, and your answers about the problem and the site.
• Your authorization: the name you sign with, the date and time, your IP address and your browser’s identification.
• Your account: your email address, used to send you sign-in links.
• Your case: our updates, your messages, the report and the dates of each step.
• Payments: Stripe (cards) or PayPal collects your payment details. We receive your name, email, the amount and a transaction number, never your card details.
• Access details: encrypted in your browser before they reach us. This website can’t read them.
• Free site checks: the address you check, your IP address (to stop abuse), the result, and your email if you ask us to send you the report.
• Your site’s data: during the work, we make an encrypted backup of your site’s files and database, which can include personal data of your own users. See our terms for how we handle it on your behalf.

Why we use it

• To provide the service you ordered and keep you informed (performance of a contract).
• To keep proof that we were authorized to work on your site, and to prevent abuse (legitimate interests).
• For accounting and tax obligations (legal obligation).

We don’t sell your data, and we don’t use it for advertising profiles.

Cookies

We only use the cookies needed to keep you signed in to your case page. We don’t use analytics or advertising cookies.

Who processes it for us

• Vercel: hosts this website.
• Supabase: stores orders and cases, and sends sign-in links.
• Stripe: takes card payments.
• PayPal: takes PayPal payments.
• Resend: sends our emails to you.
• Hetzner: servers we use for backups and the cleanup work.
• Telegram: internal alerts to our team, with case numbers and links only, never your details.
• Google (Web Risk) and abuse.ch (URLhaus): receive the address of a site you check, to look it up on their lists.

Some of these providers process data outside your country, including in the United States and Brazil. Where the law requires it, transfers rely on safeguards such as the European Commission’s standard contractual clauses.

How long we keep it

• Access details: deleted 7 days after your case closes, and never kept longer than 30 days.
• Backups of your site: deleted 7 days after delivery.
• Unpaid orders: deleted after 90 days.
• Free site checks, including any email you gave for the report: deleted after 90 days.
• Orders, cases and authorizations: kept as long as accounting and legal obligations require, up to 6 years.

Your rights

You can ask for a copy of your data, or ask us to correct it, delete it, limit how we use it, or send it to you in a portable format. You can also object to how we use it. Write to hello@sitesafeagain.com and we’ll answer within 30 days. If you’re not satisfied, you can complain to the data protection authority where you live.

Security

Access to our systems uses two-factor authentication. Only the people working on your case can open your access details, with a key kept offline.

Changes

If we change this policy, we update the date at the top of this page.